From 2e30119da71ebb9c8fbcde6ecf4f9d5b042c9974 Mon Sep 17 00:00:00 2001 From: Christian Brauner Date: Sun, 10 Dec 2017 02:41:14 +0100 Subject: [PATCH] lxccontainer: only attach netns on netdev detach Detaching network namespaces as an unprivileged user is currently not possible and attaching to the user namespace will mean we are not allowed to move the network device into an ancestor network namespace. Signed-off-by: Christian Brauner --- src/lxc/lxccontainer.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/src/lxc/lxccontainer.c b/src/lxc/lxccontainer.c index b45f99643..e34f51d08 100644 --- a/src/lxc/lxccontainer.c +++ b/src/lxc/lxccontainer.c @@ -4149,11 +4149,13 @@ static bool do_lxcapi_detach_interface(struct lxc_container *c, const char *ifna return false; } - if (pid == 0) { // child - int ret = 0; - if (!enter_net_ns(c)) { - ERROR("failed to enter namespace"); - exit(-1); + if (pid == 0) { /* child */ + pid_t init_pid; + + init_pid = do_lxcapi_init_pid(c); + if (!switch_to_ns(init_pid, "net")) { + ERROR("Failed to enter network namespace"); + exit(EXIT_FAILURE); } ret = lxc_netdev_isup(ifname); -- 2.47.2